GitHub Advisoryadvisory · PyPI
GHSA-qpxx-2cwh-r5vh pypickle Incorrect Privilege Assignment vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2025-5175
- Ecosystem
- PyPI
- Packages
- pypickle
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-266
- Reviewed
- 2025-05-27
Affected packages
• PyPI pypickle: < 2.0.0 → fixed in 2.0.0
Description
A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py. The manipulation leads to improper authorization. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.
Related
Alias · CVE (1)
- CVE-2025-5175 A vulnerability was found in erdogant pypickle up to 1.1.5. vulnerability
Weakness · CWE (1)
- CWE-266 Incorrect Privilege Assignment weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-5175 advisory
- https://github.com/erdogant/pypickle/issues/3 web
- https://github.com/erdogant/pypickle/issues/3#issue-3070689116 web
- https://github.com/erdogant/pypickle/issues/3#issuecomment-2888589652 web
- https://github.com/erdogant/pypickle/commit/14b4cae704a0bb4eb6723e238f25382d847a1917 web
- https://github.com/PrinceRaj-0/Vulnerability-Disclosure/blob/main/CVE-2025-5175.md web
- https://github.com/erdogant/pypickle package
- https://github.com/erdogant/pypickle/releases/tag/2.0.0 web
- https://github.com/pypa/advisory-database/tree/main/vulns/pypickle/PYSEC-2025-46.yaml web
- https://vuldb.com/?ctiid.310263 web
- https://vuldb.com/?id.310263 web
- https://vuldb.com/?submit.579824 web